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Introduction 


The undersigned companies (the “Companies”) have developed 
this European self-regulatory Framework (the “Framework”) for 
Online Behavioural Advertising (“OBA”). The Framework lays 
down a structure for codifying industry good practices and 
establishes certain Principles to increase transparency and choice 
for web users within the EU/EEA which are binding upon the 
Companies and Associations. The associations listed at the end 
of this document (the “Associations”) have been working jointly 
on this Framework and support its promotion across the 
advertising ecosystem. The Principles contained herein are 
intended to apply consumer friendly standards to Online 
Behavioural Advertising and the collection of online data in order 
to facilitate the delivery of advertising based on the preferences 
or interests of web users. It does not seek to regulate the content 
of online advertisements nor does it regulate Ad Delivery (as 
defined below). 


Application of the Framework and the 
Principles 


There are a number of differing laws which may apply to OBA, 
particularly in cases where the data collected or processed relates 
to an identified or identifiable natural personal and thereby 
comprises personal data. The Principles assist and encourage 
Companies to design into their systems and contracts a 
framework for compliance with applicable law as well as 
establishing protections for areas that are un-regulated. Given 
that the applicable law varies from country to country, 
compliance with these Principles does not guarantee compliance 
with any applicable law and is not a substitute for such 
compliance. These Principles provide direct benefits to web 
users, in particular by standardising consumer notices on web 
sites or within advertisements, and by creating simple 
mechanisms for accepting or declining OBA, even though 
personal data is not implicated. Web users may make complaints 
about incidents of suspected non-compliance with the Principles 
against the Companies by following the procedures set out in 
the Principles. 


The Framework applies to OBA focusing on web viewing 
behaviour over time and across multiple web domains not under 
Common Control in order to create interest segments or to 
allocate such viewing behaviour against interest segments for the 
purposes of delivering advertisements to and by that web user’s 
interests and preferences. 


The Framework does not apply to web viewing behaviour for a 
particular web site or related web sites under Common Control. 
The Framework applies across the Internet “ecosystem”. The 
Framework has separate provisions for Web Site Operators, Third 
Parties and providers of desktop application software that 
engage in OBA. The Framework recognises that a Company may 
conduct a number of different activities, and therefore the 
Framework recognises that different Principles and types of 
notice and consent may therefore be applicable to each different 
activity. 


Definitions 


Ad Delivery 


Ad Delivery is the delivery of online advertisements or 
advertising-related services using Ad Reporting data. Ad Delivery 
does not include the collection and use of Ad Reporting data 
when such data is used to deliver advertisements to a computer 
or device based on user preferences or interests inferred from 
information collected over time and across sites not under 
Common Control. 


Ad Reporting 


Ad Reporting is the logging of page views on a web site or the 
collection or use of other information about a browser, operating 
system, domain name, date and time of the viewing of the web 
page or advertisement, and related information for purposes 
including, but not limited to: 


© Statistical reporting in connection with the activity on a web 
site(s); 

@ Web analytics and analysis; and 

@ Logging the number and type of ads served on a particular 
web site(s). 


Control 


Control of an entity means that another entity (1) holds a 
majority of the voting rights in it, or (2) is a member of it and 
has the right to appoint or remove a majority of its board of 
directors, or (3) is a member of it and controls alone, pursuant 
to an agreement with other members, a majority of the voting 
rights in it, or (4) has placed obligations upon or otherwise 
controls the policies or activities of it by way of a legally binding 
contract, or (5) otherwise has the power to exercise a controlling 
influence over the management, policies or activities of it, and 
“Controlled” shall be construed accordingly. 


Common Control 


Entities or web sites under Common Control include ones which 
Control, for example parent companies, are Controlled by, such 
as subsidiaries, or are under common Control, such as group 
companies. They also include entities that are under a written 
agreement to process data for the controlling entity or entities, 
and do such processing only for and on behalf of that entity or 
entities and not for their own purposes or on their own behalf. 


Icon 
An Icon is a visible web based object that contains a hyperlink to 


the OBA User Choice Site or to the Third Party Notice described 
in L.A.1. 


Explicit Consent 


Explicit Consent means an individual’s freely given specific and 
informed explicit action in response to a clear and 
comprehensible notice regarding the collection and use of data 
for Online Behavioural Advertising purposes. 


Online Behavioural Advertising (OBA) 


Online Behavioural Advertising means the collection of data from 
a particular computer or device regarding web viewing 
behaviours over time and across multiple web domains not 
under Common Control for the purpose of using such data to 
predict web user preferences or interests to deliver online 
advertising to that particular computer or device based on the 
preferences or interests inferred from such web viewing 
behaviours. Online Behavioural Advertising does not include the 
activities of Web Site Operators, Ad Delivery or Ad Reporting, or 
contextual advertising (e.g. advertising based on the content of 
the web page being visited, a consumer's current visit to a web 
page, or a search query). 


OBA User Choice Site 


A consumer focussed web site and education portal 
(www.youronlinechoices.eu), available in all official EU and the 
additional EEA languages, that provides a mechanism for web 
users to exercise their choice with respect to the collection and 
use of data for Online Behavioural Advertising purposes by one 
or more Third Parties or links to a mechanism permitting user 
choice over Online Behavioural Advertising. 


Third Party 


An entity is a Third Party to the extent that it engages in Online 
Behavioural Advertising on a web site or web sites other than a 
web site or web sites it or a an entity under Common Control 
owns or operates. 


Web Site Operator 


A Web Site Operator is the owner, controller or operator of the 
web site with which the web user interacts. 
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Principle I. 


Principle Il. 


Notice 


A. Third Party Notice 


1. Third Party Privacy Notice—Third Parties should give clear 
and comprehensible notice on their web sites describing 
their Online Behavioural Advertising data collection and use 
practices. Such notice should include clear descriptions of 
the following: 


(a) Their identity and contact details; 


(b) The types of data collected and used for the purpose of 
providing OBA, including an indication or whether any data 
is “personal data” or “sensitive personal data” as defined by 
the national implementation of Directive 95/46/EC; 


(c) The purpose or purposes for which OBA data is processed 
and the recipients or categories of recipient not under 
Common Control and to whom such data might be 
disclosed; 


(d) An easy to use mechanism for exercising choice with 
regard to the collection and use of the data for OBA purposes 
and to the transfer of such data to Third Parties for OBA; 


(e) The fact that the Company adheres to these Principles; and 
(f) A link to the OBA User Choice Site. 
2. Third Party Enhanced Notice to Consumers 


(a) In addition to providing notice as described in A.1, Third 
Parties should provide enhanced notice of the collection of 
data for OBA purposes via the Icon in or around the 
advertisement; and 


(b) Third Parties may provide notice via the Icon on the web 
page where the data for OBA purposes is collected if there 
is an arrangement with the Web Site Operator for the 
provision of such notice. 


B. Web Site Operator Notice 


In addition to complying with applicable existing legal 
obligations, when a Web Site Operator permits data to be 
collected from and used on a web site for OBA purposes by Third 
Parties, the Web Site Operator should provide adequate 
disclosure of this arrangement. The Web Site Operator does not 
need to include such disclosure in instances where the Third 
Party provides notice as described in I.A.2. 


User choice over Online Behavioural Advertising 


A. Each Third Party should make available a mechanism for web 
users to exercise their choice with respect to the collection 
and use of data for OBA purposes and the transfer of such 
data to Third Parties for OBA. 
available from the notice described in I.A.1 and via the OBA 
User Choice Site. 


Such choice should be 


B. To the extent that Companies collect and use data via specific 
technologies or practices that are intended to harvest data 
from all or substantially all URLs traversed by a particular 
computer or device across multiple web domains and use 
such data for OBA, they should first obtain Explicit Consent. 


C. Companies that have obtained Explicit Consent pursuant to 
II.B should provide an easy to use mechanism for web users 
to withdraw their Explicit Consent to the collection and use 
of such data for OBA. 


Principle III. 
Data Security 


A. Safeguards 

Companies should maintain appropriate physical, electronic, and 
administrative safeguards to protect the data collected and used 
for Online Behavioural Advertising purposes. 

B. Data Storage 

Companies should retain data that is collected and used for 


Online Behavioural Advertising only for as long as necessary to 
fulfil a legitimate business need, or as required by law. 


Principle IV. 


Sensitive Segmentation 
A. Children’s segmentation 


Companies agree not to create segments for OBA purposes that 
are specifically designed to target children. For the purposes of 
this provision, ‘children’ refers to people age 12 and under. 


B. Other Sensitive Segments 


Any Company seeking to create or use such OBA segments 
relying on use of sensitive personal data as defined under Article 
8.1 of Directive 95/46/EC will obtain a web user’s Explicit 
Consent, in accordance with applicable law, prior to engaging 
in OBA using that information. 
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Principle V. 


Education 


Companies that engage in OBA should provide information to 
inform individuals and businesses about OBA, including easily 
accessible information about how data for OBA purposes is 
obtained, how it is used and how web user choice may be 
exercised. This may include information in easy-to-understand 
language and user-friendly format (such as online video). 
Companies and Associations are encouraged to use a consistent 
or common resource for such educational information. 


Principle VI. 


Compliance and Enforcement Programmes 
A. Applicability and Eligibility 


This Framework is self-regulatory in nature and creates obligations 
for any signatory Company that self-certifies compliance with 
the Principles and obligations contained herein. Following the 
adoption of this Framework and the Icon each Company should 
comply and self certify by 30 June 2012. Companies adopting 
the Framework later than 1 January 2012 should comply and self 
certify within 6 months of adopting the Framework and the Icon. 


B. Compliance and Self-certification 


Self-certification of compliance shall be limited to those 
requirements applicable to each Company’s business model. In 
the event that a single Company may be subject to multiple 
obligations, self-certification must cover all such applicable 
provisions. Self-certification of compliance with this Framework 
does not exempt Companies from fulfilling their obligations 
under applicable national laws. 


C. Auditing of Self-certification 


Companies that are subject to Principle II shall submit to 
independent audits of their self-certification. Audits should be of 
sufficient scope to review compliance of Companies engaging 
in OBA in the EU and EEA Member States. Such independent 
audits must demonstrate, at a minimum, the following attributes: 


a) Processes for individual and independent review of 
Company web sites for the purpose of validating compliance 
with obligations under this Framework; 


b) Processes for automated or individualised periodic 
monitoring of a statistically significant number of web sites 
where objective evidence of compliance with Principles | and 
Il in this Framework can be verified; 


c) Processes for resolving identified areas of non- 


compliance directly with the signatory Company in a 
transparent manner and within a reasonable period of time; 


d) Publication of decisions in case of un-rectified non- 
compliance with any commitments made under this 
Framework, as well as the findings of general good 
compliance, for one or multiple Companies that have self- 
certified under this Framework. 


D. Consumer Complaints Handling 


Programmes under this Framework for complaints handling shall 
include the following elements: 


a) Easily accessible mechanisms for complaints to be filed 
directly to Companies; 


b) Transparent, easily recognisable and accessible 
mechanisms for handling complaints through independent, 
alternative dispute resolution 
advertising self-regulatory bodies; 


mechanisms such as 


c) Coordination between Companies and alternative 
dispute resolution mechanisms, including advertising self- 
regulatory bodies, to ensure that Companies engaged in 
OBA are not unreasonably subject to multiple enforcement 
mechanisms regarding compliance with the obligations of 
the Framework; 


d) Consumers filing complaints to a complaints handling 
body, including advertising self-regulatory organisations 
shall have access to a simple complaint handling 
mechanisms in their local language; 


e) Publication of decisions in case of non-compliance with 
the commitments under this Framework, including in the 
language of the country where the complaint was first 
launched. 


In addition, Companies that are subject to this Principle shall 
collaborate to make available the OBA User Choice Site. 


E. Relationship between Compliance Programmes: 


Administrators of relevant auditing and compliance 
programmes, including existing advertising self-regulatory 
systems in the context of processing consumer complaints, 
should ensure effective coordination, including promoting a 
common audit form within the EU and EEA Member States and 


with other regions or countries such as the USA. 


Administrators of relevant compliance programmes should also 
coordinate to ensure transparency, consistency and coherence 
of the implementation and enforcement across EU and EEA 
Member States. 
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Principle VII. 


Review 


The undersigning Companies and Associations shall regularly review this Framework at least every 3 years in response to the 
development of OBA and business practices, and modify or add to the Framework as appropriate. 


Participating companies 


A list of all companies participating in the EU Self-Regulatory Programme on OBA, and thus adhering to the principles 
laid out in this Framework, can be found at: 


http://www.edaa.eu/participating-companies/ 


or 


http://www.youronlinechoices.eu/goodpractice.html 


CONTACT 


EDAA 

26, Rue des Deux Églises 
1000, Brussels 

Email: info@edaa.eu 


Call: +32 (0) 2 513 78 06 


